# AGENT-PROMPT-v5-P1-1b — Piece D Reject #1 remediation approval

**Date:** 2026-08-07
**Follows:** `docs/AGENT-PROMPT-v5-P1-1b-piece-d-goahead.md`,
`docs/AGENT-PROMPT-v5-P1-1b-piece-d-mapping-amendment-a-approval.md`,
`docs/AGENT-PROMPT-v5-P1-1b-piece-d-mapping-amendment-b-approval.md`,
`docs/AGENT-PROMPT-v5-P1-1b-piece-d-mapping-amendment-c-approval.md`,
`docs/p1-1b-status.md` ("Piece D Reject #1 — Step 2 remediation mapping"),
`docs/p1-1b-o10-independent-review.md` ("Piece D Reject #1 remediation mapping — Step 2
approval gate"), and `docs/PROJECT-STATE.md`
**Authority:** Miguel
**Stage:** governed records only

## Decision: approved

Miguel's approval, recorded verbatim:

> Aprovo a remediação da Piece D: D-R1, D-R2, D-R1-O1, D-R1-O2, D-R1-O3 e D-R2-O1.

This approves the complete Piece D Reject #1 remediation mapping as the binding test plan for the
second and final Piece D attempt before escalation. It reopens no prior decision and changes no
baseline, pin, accepted object, or previously approved Piece D amendment.

## Approved contract, item by item

### D-R1 — independent accepted-P1-1a oracle

1. Add exactly one new helper,
   `CreatePieceDPristineP11aOracleDatabaseAsync`. In the same disposable PostgreSQL 17
   container/invocation, it creates a second isolated database, migrates that database directly
   from empty only through `20260805180000_P11aFdrSchema`, and captures immutable S0 before any
   Piece A+B+C `Up` runs in the separate cycle database. S0 is never derived, recaptured, or
   rebased after a full-tip/`Down` cycle.
2. Add exactly one new fixture, `PieceDPristineP11aOracleFixture`, using xUnit
   `IAsyncLifetime`/class-fixture lifecycle. Before any `[Fact]` in
   `P11aDisposableDatabaseTests`, initialization asserts the fresh-cluster preconditions, calls
   the helper, retains immutable S0, and cleanup drops the oracle database fail-safely.
3. Strengthen, without adding another test method,
   `Piece_d_combined_cumulative_up_down_up_over_a_plus_b_plus_c_matches_accepted_p1_1a_and_is_stable`.
   It consumes fixture S0 and takes S1/S2/S3 from the separate cycle database. It proves
   `Assert.Equal(S0,S2)` across independent origins, `Assert.Equal(S1,S3)` for determinism, and
   `Assert.NotEqual(S0,S1)` for sensitivity. The complete logical and physical snapshot includes
   roles, ACLs, functions, triggers, constraints, indexes, and migration history, normalizing only
   non-contractual physical identities.
4. Re-run unchanged the existing Piece A, Piece B, and Piece C exact-Down/Up-Down-Up catalog
   stability regressions. They remain secondary regressions and never substitute for the
   independent oracle.

### D-R2 — exact `ImportEvidenceRow` constraint/index proof

1. In the same strengthened combined method, reuse unchanged
   `ImportEvidenceRowUniqueConstraints(connectionString)` and
   `ImportEvidenceRowIndexes(connectionString)` at S0, S1, S2, and S3.
2. At every checkpoint assert cardinality exactly four and these four exact
   `pg_get_constraintdef` values:
   1. `UNIQUE NULLS NOT DISTINCT ("ImportBatchId", "SourceTable", "SourcePermanentCode")`
   2. `UNIQUE NULLS NOT DISTINCT ("ImportBatchId", "SourceTable", "SourceRecordKey")`
   3. `UNIQUE ("Id", "TargetTable", "TargetPermanentCode")`
   4. `UNIQUE ("Id", "CompanyCode", "TargetTable", "TargetPermanentCode")`
3. Then assert `uniqueS0 == uniqueS1 == uniqueS2 == uniqueS3` and
   `indexS0 == indexS1 == indexS2 == indexS3`. Equality never replaces checkpoint cardinality
   and literal-definition assertions.
4. Re-run unchanged
   `Piece_a_accepted_import_evidence_uniqueness_and_indexes_are_identical_from_accepted_to_first_up`
   as secondary evidence, never as a substitute for the in-method S0–S3 assertions.

### D-R1-O1 — approved meaning of one disposable run

“One disposable PostgreSQL 17 run” means one container/test invocation containing two isolated
databases: one pristine accepted-P1-1a oracle database and one cycle database. It does not mean
exactly one database. S0 is captured from the pristine database before any Piece A+B+C `Up` in the
cycle database.

### D-R1-O2 — fixed order and cluster-global roles

Because roles are cluster-global, execution order is fixed: capture immutable S0 before any Piece C
cluster-global role is created; only then may the separate cycle database execute Piece A+B+C.
S2 must expose any leaked cluster-global state. Database names are unique, cleanup/drop is
guaranteed fail-safely, the combined method does not execute in parallel, and S0 is never
recaptured or rebased.

### D-R1-O3 — fixture lifecycle and fresh-cluster fail-closed gate

The class fixture owns and invokes the helper before every Fact in the class can run. Initialization
fails closed unless the canonical runner enters on a fresh cluster: no cluster-global
`sibyla_piece_c_executor` exists and the pristine runner database contains no applied Piece A/B/C
history. Implementation verification must statically confirm the `Category=P11aDatabase`
shared-connection participation and fail closed if another class can mutate the cluster before this
fixture. If the canonical runner cannot guarantee that ordering, D-R1 remains infeasible and the
implementation must stop and escalate rather than adapt around the contract.

### D-R2-O1 — cardinality/definitions without a generated-name contract

Every checkpoint binds cardinality four and the four exact `pg_get_constraintdef` values above.
Dictionary equality across checkpoints also compares the observed names, but this approval creates
no stable contract over generated constraint names. The definitions and cardinality are the stable
contract; name equality is a within-run stability proof.

## Inventory, retained amendments, and escalation rule

The approved inventory is exactly **0 new test methods, 1 new helper, 1 new test fixture, 1
strengthened shared test method, and 4 unchanged existing regression methods**. Every surface that
previously passed remains a regression requirement and no prior surface is reopened. Option A,
D-M2-A, and D-M3-A+ remain operative. All accepted objects, all eight accepted migration/SQL files,
and `RejectTerminalDOCFLGMutationFn` remain untouched. This is the second and final Piece D attempt
before escalation; a second Reject stops and escalates to Miguel.

## Exact authority granted

This approval authorizes **only ordered instruction 3** of the Piece D attempt #2 sequence, and
only after the records commit containing exactly this approval document, `docs/p1-1b-status.md`,
and `docs/PROJECT-STATE.md` is committed and pushed to `origin/feature/p1-1b`. TDD must start fresh
from that pushed approval tip and implement only the contract above together with unchanged Option
A, D-M2-A, and D-M3-A+.

This approval does **not** authorize ordered instruction 4, Scope 1, checklist item 5's deferred
real-population proof, O5, any merge, any project-evolution update, any importer/import execution,
any production/shared/live database write, any migration/DDL/accepted-object change, any baseline
or pin change, or any prototype write/post-pin content adoption. A candidate produced under
instruction 3 still requires a separately authorized fresh independent integration-focused review.

## Records instruction

Record this approval in `docs/p1-1b-status.md` and update every current-facing Piece D location in
`docs/PROJECT-STATE.md` in the same commit, preserving the mapping, neutralization, Reject, and all
other historical entries intact. The exact versioned path set is:

1. `docs/AGENT-PROMPT-v5-P1-1b-piece-d-remediation-approval.md`
2. `docs/p1-1b-status.md`
3. `docs/PROJECT-STATE.md`

No other versioned path belongs to this records stage.